???????????????????????:?????????

????1??????17???????????????????????? ?17???????????????,??

?

2024??????12?????????????????18?,??????????????????????CNCERT?(

????????????????????

(??????)???

2024????????????????????????8?????????????????19???????????????????,??,??????/???????????????????????????2024???????????????????????8?????????????21?,?????????????????????/????????????????

(???????????)???????

2024????8??????21??????????????????????????????12??????????,???????????????????,????????,????????????????????,???????????????????????????/xxx/xxxx?flag=syn_user_policy????????????,?/xxx/xxxStats?

(????)????????????????????

2024????????????11??6???????2024?????????????????????????????????11?????????????8???2024??11??????????16????????????????????,?276????????????????????????

????????????????????

(???????????????)????

?IP????,????,???????????????,??????????????????????????,??????

(??????????????)????

2024?????11??6????????????11?16??????????????,?3?IP????????????,?,????????????????,????????????????????????????????,?,????????????????4.98GB?

????????????????????????

(??????????????)??????????

?????????,??????????????22?8???????,?????????10?20?,??????????????,???

(??????????)?

???5?IP??????????????????????,???????????,???

(?)?????????

?????????????,??????????,?????????????

??????,???????????,????????????

(?)??????????????????

????,??????????,?,?????276??????,???????????????????????????,?????????????????????????????

??????????IP??

????

2024??????12???????18?,??CNCERT????(

????????

(??????????????)?????????????

?Exchange???????????????????????2?Exchange???????????????,??????,?,???????????????

(????????)?????

????,????????????2?????,????????,?????????????????,?/owa/auth/xxx/xx.aspx??/owa/auth/xxx/yy.aspx,??????????????????,?,??????????

(?)????????????????????????????30????????????????

????????????,???????????????????????????,??,??SSH?SMB??????30????????????????;??????,????????????????????????????????????????????????????????????????????????????????????,??????????websocket+SSH?????????????,??????????????,?WeChatxxxxxxxx.exe??2???PIPE?????????,??????????????????????

??????????????????????????????

(??????????????????????)?

?????,?????????????????????????,?,??,??,??????

(????)??????????

?3???????????,??????????????????????,2023????5???????????2???????????????????????????,?(95.179.XX.XX)????????,?,???????,???,??????“??????”?“???????????????”?“?”?“???????(?+????????)”?“?IP?”?“??”??????

(??????????????)?

????????????,????????????????????????????,2023????7?????????26????????????????,???????????????????????????(65.21.XX.XX)???????????????????,?????????????????,???????????,?,??????????????1.03GB??,?????????????“?????????????”???????“tip4XXXXXXXX.php”?

(???????)????????????

????,?,???????????????????????,??????????????????????????????????SSH??????,?????,????????????????????

???

(?)?

??????????????,?22??????????????8?,????10??????????20????,??????????????????,???

(?????????)???

2023???????????5????????2023??10????????????????,?30??????????????????????,?IP?,??

(??????????)?

????2?PIPE???“c:\windows\system32\”?,??????.net???????????????????,?,??????????KB,????TLS??????????????????????????????,??https?,??websocket+SSH??????????????,????????????????????????

???IP??